Re: Would You Fly an Airplane with a Linux-Based Control System?

From: Alexander E. Kopilovich (aek_at_VB1162.spb.edu)
Date: 11/26/04 

Date: Fri, 26 Nov 2004 06:11:11 +0300 (MSK)
To: comp.lang.ada@ada-france.org

Mike Silva wrote:

> A small but, I think, important correction. The hardware at the
> center of the failure was apparently built around the Motorola
> 68020/68881 chips, not the MIL-STD-1750. The "Operand Error" that
> triggered the failure is a hardware exception generated by the FPU
> when, among other conditions, a float-to-integer conversion exceeds
> the capacity of the integer, exactly as occurred. The reason this is
> important is because it shows that the exception was not generated by
> the Ada compiler code but by the hardware, and would therefore have
> occurred regardless of the programming language used. If that's the
> case then the "it wouldn't have exploded if it were written in C"
> argument evaporates, unless they want to argue that the exception
> handler behavior would have been specified differently if the
> implementation language was C -- not likely!

I think that the fact that the chain of events was initiated by FPU exception
really deserves to be mentioned. Therefore I'm going to update my own
Ariane 5 FAQ appropriately. Currently, 8th Q-A pair of it reads as follows:

----------------------------------------------------------------------------

Q. Can you explain in several words what was the actual cause of the launch
failure, technically?

A. There are several points which are different for Ariane 5 vs. Ariane 4,
one of which was instrumental to the events: Ariane 4 is a vertical launch
vehicle where as Ariane 5 is slightly tilted.
  Ariane 4 software was developed to tolerate certain amount of inclination
but not as much as required by Ariane 5. The chain of events were as follows:

- The on-board software detects that one of the accelerometers is out of range,
this was interpreted as hardware error and caused the backup processor to take
over;
- The backup processor also detects that one of the accelerometers is out of
range (the same way), which caused the system to advice an auto destruction.

----------------------------------------------------------------------------

It seems that the following modification of the description of the chain of
events takes your suggestion into account:

----------------------------------------------------------------------------

- The on-board software detects that one of the accelerometers is out of
range (actually, there was FPU exception generated when float-to-integer
conversion exceeded the capacity of the integer), this was interpreted as
hardware error and caused the backup processor to take over;
- The backup processor also detects that one of the accelerometers is out of
range (the same way), which caused the system to advice an auto destruction.

----------------------------------------------------------------------------

Do you agree that this addition is enough there? Or particular processor
model is of some importance also?

Alexander Kopilovich aek@vib.usr.pu.ru
Saint-Petersburg
Russia

Relevant Pages

  • Re: random XP crashes
    ... call to the handler for a prior exception. ... double fault. ... A kernel stack overflow. ... One of three types of problems occurred in kernel-mode: Hardware ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: How to get crash dump when a unhandled CException is thrown by a MFC app
    ... hardware problem. ... failure at least once a day, which caused an exception to be thrown, and we recovered. ... So I do not believe that throwing an exception should terminate a program; ... "Go and fix your machine", ...
    (microsoft.public.vc.mfc)
  • Re: weird error message
    ... call to the handler for a prior exception. ... double fault. ... A kernel stack overflow. ... One of three types of problems occurred in kernel-mode: Hardware ...
    (microsoft.public.windowsxp.general)
  • Re: Structured exception information
    ... Write_Output for different hardware will need need a corresponding ... version of the exception type; ... the messages are indeed string literals, ... The Ada compiler checks coverage. ...
    (comp.lang.ada)
  • Re: Ariane
    ... "If you had been in the project software specification panel, what course of action would you have suggested to handle the exception 'acceleration value does not fit into the 16-bit integer range' when you know that the sensor works correctly and that the physical upper bound must fit ?" ... It turns out there simply was no requirements document for the INS of the Ariane 5 at all, so nobody ever considered the question you asked above. ... navigation system, there were two flaws on the system engineering level: First, only hardware failures were considered in the design; thus, when the exception occured, the INS just threw in the towel instead of trying to continue on a best-effort basis. ...
    (comp.lang.fortran)